Siemens IoT2050 Node-RED RCE (CVE-2026-58115) hit in the wild

Attackers are exploiting a maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced gateways to run code and pull down Linux malware, VulnCheck reported. The bug, CVE-2026-58115, is a CVSS 10.0 missing-authentication issue in the Node-RED HTTP interface that lets an unauthenticated remote attacker create flows and execute system commands. If you run an IoT2050 with Node-RED exposed, patch today.

What's affected

Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed, on all builds before V4.3.4.1. The root cause is CWE-306: the Node-RED editor and admin API ship without authentication, and Node-RED's programming nodes can run shell commands, so reaching the HTTP interface is equivalent to code execution with full privileges. Siemens documented the flaw in advisory SSA-834709, published August 11, 2026, and CISA tracked it as ICSA-26-237-03.

Exploitation status

VulnCheck says it observed exploitation attempts against its honeypot network beginning October 30, 2026, after publishing detection guidance on October 27. Its writeup — summarized by The Hacker News and SecurityOnline — describes a Node-RED flow wired to an exec node, used to fetch an AMD64 bot binary. VulnCheck added the CVE to its own exploited-vulnerability catalog; as of writing it is not in CISA's KEV. VulnCheck did not retrieve the later-stage payloads, so the "backdoor" framing reflects attempted deployments, not confirmed infections.

Indicators, as published by VulnCheck via The Hacker News:

Loader host (wget, curl fallback):  85.215.73[.]250
First-stage binary written to:      /dev/shm/.b
Second-stage script:                wget.sh (same host)
Second payload host:                45.194.90[.]57:38472
Second payload / disk path:         .sys_update -> /tmp/.kworker

VulnCheck could not retrieve wget.sh or .kworker, so their function is unknown — treat the hashes/paths as leads, not a confirmed kill chain.

Action checklist

1. Update Industrial OS to V4.3.4.1 or later, per SSA-834709. That is the fix; everything below is interim.
2. Get the Node-RED interface off any untrusted network. Front it with a VPN; do not expose the editor, admin API, or dashboard to the internet.
3. If you can't patch now, uninstall Node-RED, or harden it: enable HTTPS, require credential or OAuth/OpenID auth on the editor and admin API, and apply basic auth to HTTP nodes and the dashboard.
4. Hunt for the IOCs above and for unexpected flows containing exec nodes, writes to /dev/shm/.b or /tmp/.kworker, and outbound connections to the listed hosts.

Context

This is the same failure mode behind the European supermarket refrigeration attacks: an OT device with a management interface reachable over the network and no authentication in front of it. The Node-RED exposure is broader than Siemens hardware — the same unauthenticated-admin pattern affects any Node-RED instance put on a public port — but a shipped industrial gateway that enables it by default raises the stakes. The advisory is three months old; the news is that scanning has turned into weaponization.